{"id":"GHSA-f28g-86hc-823q","aliases":["GO-2023-1914"],"status":"published","title":"Tokenizer vulnerable to client brute-force of token secrets","description":"### Impact\n\nAuthorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header.\n\n### Patches\n\nThis was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in https://github.com/superfly/tokenizer/pull/9.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-07-13T19:56:19Z","modified":"2024-05-20T21:54:03Z","fixes":[{"ecosystem":"Go","package":"github.com/superfly/tokenizer","fixed_in":["0.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/superfly/tokenizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/superfly/tokenizer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/superfly/tokenizer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.1"}]}]}],"references":[{"url":"https://github.com/superfly/tokenizer/security/advisories/GHSA-f28g-86hc-823q","tags":["web"]},{"url":"https://github.com/superfly/tokenizer/pull/8","tags":["web","fix"]},{"url":"https://github.com/superfly/tokenizer/pull/9","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-f28g-86hc-823q","tags":["advisory"]},{"url":"https://github.com/superfly/tokenizer","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f28g-86hc-823q","title":"Tokenizer vulnerable to client brute-force of token secrets","description":"### Impact\n\nAuthorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header.\n\n### Patches\n\nThis was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in https://github.com/superfly/tokenizer/pull/9.","status":"published","published":"2023-07-13T19:56:19Z","modified":"2024-05-20T21:54:03Z","updated_at":"2026-11-02T14:37:51.549437Z"}],"osv":[{"id":"GHSA-f28g-86hc-823q","title":"Tokenizer vulnerable to client brute-force of token secrets","description":"### Impact\n\nAuthorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header.\n\n### Patches\n\nThis was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in https://github.com/superfly/tokenizer/pull/9.","status":"published","published":"2023-07-13T19:56:19Z","modified":"2024-05-20T21:54:03Z","updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"GO-2023-1914","title":"Brute-force of token secrets in github.com/superfly/tokenizer","description":"Brute-force of token secrets in github.com/superfly/tokenizer","status":"published","published":"2023-07-25T22:53:02Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}